fix: resolve codeql security findings in cert generation and static handler

🤖 Generated with [OpenCode](https://opencode.ai) (Smart-router)

Author: daquinoaldo

src/certs.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { exec } from "node:child_process"
+import { execFile } from "node:child_process"
 import fs from "node:fs"
 import https from "node:https"
 import path from "node:path"
@@ -84,23 +84,16 @@ function download(url: string, destination: string): Promise<void> {
 }
 
 async function runMkcert(appDataPath: string, exe: string, domain: string): Promise<void> {
-  const escapeSpaces = (value: string): string => {
-    if (process.platform === "darwin" || process.platform === "linux")
-      return value.replace(/(?<!\\) /g, "\\ ")
-    if (process.platform === "win32") return '"' + value + '"'
-    return value
-  }
-
-  const exePath = escapeSpaces(path.join(appDataPath, exe))
-  const crtPath = escapeSpaces(path.join(appDataPath, domain + ".crt"))
-  const keyPath = escapeSpaces(path.join(appDataPath, domain + ".key"))
-  const command = `${exePath} -install -cert-file ${crtPath} -key-file ${keyPath} ${domain}`
+  const exePath = path.join(appDataPath, exe)
+  const crtPath = path.join(appDataPath, domain + ".crt")
+  const keyPath = path.join(appDataPath, domain + ".key")
+  const args = ["-install", "-cert-file", crtPath, "-key-file", keyPath, domain]
 
   if (process.platform === "win32") await new Promise(resolve => setTimeout(resolve, 3000))
 
   return new Promise((resolve, reject) => {
     console.log("Running mkcert to generate certificates...")
-    exec(command, (error, stdout, stderr) => {
+    execFile(exePath, args, (error, stdout, stderr) => {
       if (stdout) console.log(stdout)
       if (stderr) console.error(stderr)
       if (error) {

src/index.ts

@@ -54,13 +54,15 @@ const createServer = (domain = process.env["HOST"] || "localhost"): HttpsLocalho
   }
 
   app.serve = function (staticPath = process.cwd(), port = Number(process.env["PORT"]) || 443) {
+    const p404 = staticPath + "/404.html"
+    const index = staticPath + "/index.html"
+    const fallbackPath = fs.existsSync(p404) ? p404 : fs.existsSync(index) ? index : undefined
+
     app.use(express.static(staticPath))
-    app.use((req: Request, res: Response) => {
-      const p404 = staticPath + "/404.html"
-      const index = staticPath + "/index.html"
-      if (fs.existsSync(p404)) res.status(404).sendFile(path.resolve(p404))
-      else if (fs.existsSync(index)) res.status(200).sendFile(path.resolve(index))
-      else res.status(404).send(req.path + " not found.")
+    app.use((_req: Request, res: Response) => {
+      if (fallbackPath === p404) res.status(404).sendFile(path.resolve(p404))
+      else if (fallbackPath === index) res.status(200).sendFile(path.resolve(index))
+      else res.status(404).send("Not found.")
     })
     console.info("Serving static path: " + staticPath)
     void app.listen(port)

test/test.ts

@@ -22,7 +22,7 @@ async function closeServer(server: Server | undefined) {
   await new Promise(resolve => server.close(resolve))
 }
 
-function makeRequest(
+async function makeRequest(
   path = "/",
   secure = true,
   port: number | string = HTTPS_PORT,
@@ -37,6 +37,8 @@ function makeRequest(
     path: path,
     method: "GET",
     headers: { "accept-encoding": "gzip" },
+    // Disabling certificate validation is intentional in test suite for testing localhost self-signed certificates
+    // codeql[js/disabling-certificate-validation]
     rejectUnauthorized: false,
     agent: false,
   }